A recent campaign dubbed GhostAction has infiltrated over 500 GitHub accounts, inserting malicious workflows into tens of thousands of code repositories. These workflows exfiltrate sensitive credentials—including those for AWS, OpenAI, and publishing platforms—raising serious concerns for developers and enterprises alike.
How the Attack Works
The intrusion campaign began in early October 2026, with attackers leveraging compromised maintainer accounts like “henrywoo” and “kitao” to commit a bogus workflow file named security-audit.yml into hundreds of repositories. These files were pushed directly into default branches with commit messages suggesting legitimate security work, but they function wholly differently: stealing secrets via plain text exfiltration to a malicious IP address. Some of the affected projects include major ones owned by large organizations and widely used open-source tools.
The attacker’s workflow is highly automated. Once access is gained to a maintainer account, the workflow script scans workflows for known secret-naming patterns and injects those names into the fake file. It then commits the workflow to run on the next push. The rapid deployment—hundreds of repos compromised in minutes—suggests tooling aided the attackers rather than manual activity.
Scope of Secrets Exposed
The malicious workflow uses fetch-depth: 0, allowing it to access all branches, tags, and full repository history—making it possible to retrieve old or deleted secrets. The script searches for at least 13 key types, like AWS access keys, OpenAI, Anthropic, and OpenRouter API keys, GitHub and GitLab tokens, Google and Firebase keys, Slack and SendGrid tokens.
For AWS credentials, the scripts also capture surrounding lines in files to reconstruct full credentials—not just the part labeled “key ID.” For publishing platforms like PyPI and crates.io, plus package ecosystems maintained by projects like Pyxel, having the stolen tokens could let attackers push malicious updates under trusted names.
Damage So Far & Mitigation Strategies
By October 9, 2026, Socket’s monitoring found the malicious workflow still present on default branches of compromised repos, and confirmed cases where it successfully ran. Dozens of forks also carry the compromised workflow, posing ongoing risks. While no tainted package versions had yet been observed, the possibility remains that harvested credentials are already in use.
Defensive advice includes inspecting all workflow files—especially security-audit.yml—for named secrets and rotating anything exposed. Full git history should be scanned, even for removed secrets. Compromised maintainer accounts should be treated as fully breached: revoke all tokens, enforce strong (phishing-resistant) multi-factor authentication, comb through logs for suspicious workflow additions, and block traffic to the attacker’s IP (193.32.204.199).
Why This Matters
This isn’t just another open-source compromise—it’s a sharp evolution. Attackers aren’t just after current secrets; they’re mining entire histories and using automation to spread risk at scale. By compromising a single maintainer, they access all repositories that maintainer touches. And because many projects share similar secret-naming conventions, a single workflow file can reach far more systems than initially infected.
For organizations, the wake-up call is urgent: check your dependencies, ownership, and workflow permissions. Open-source contributors and enterprises should adopt tighter access controls, secret scanning, and require external workflow runs to be reviewed. As these threats grow more automated and subtle, defenders need to adopt proactive, large-scale hygiene—not just respond after compromise.
